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DETAILED ACTION 

1. This is in response to tine Amendment and Remarks filed on 10/24/2005. Claims 
1-8 and 13-33 and new claims 35 and 36 are presented for examination. 

Claim Rejections - 35 USC § 102 

2. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under 
section 122(b), by another filed in the United States before the invention by the 
applicant for patent or (2) a patent granted on an application for patent by 
another filed in the United States before the invention by the applicant for patent, 
except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application 
filed in the United States only if the international application designated the 
United States and was published under Article 21(2) of such treaty in the English 
language. 

3. Claims 1-8, 13-24 and 35-36 are rejected under 35 U.S.C. 102(e) as being 
anticipated by Giroir et al., (hereafter Giroir), U.S. pat. No.6,760,771. 

As to claim 1, Giroir discloses a communication switch comprising: 

at least one input (input/IP datagram sent from client 501 fig. 5) for receiving 

messages, each message including, 

an address specifier and a port specifier (using IP datagram including source 

and destination port, see fig. 3, col. 5 line 57 to col. 6 line 41). 

a traffic analyzer (DT traffic analyzer 51 1 fig. 5) to compare the port specifier of 

a first message against the port specifiers of previously received messages and an 
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output for reporting a result of the comparison to a remote location (server 503 fig. 5) 
(see col. 7 line 24 to col. 8 line 43 and col. 10 lines 13-65). 

As to claims 2 and 3, Giroir discloses a usage tracking system to throttle traffic through 
the communication switch and means to throttle traffic based on a number of messages 
having a common address specifier and port specifier (see col. 10 line 45 to col. 11 line 
57 and col. 12 lines 30-64). 

As to claims 4 and 5, Giroir discloses the usage tracking system includes means to 
throttle traffic according to a predetermined maximum aggregate bandwidth (using 
capacity of servers) for the communication switch, the predetermined maximum 
aggregate bandwidth received from the remote location and reporting fraud over the 
output to a service provider from a remote location (implementing service providers, see 
col.1 lines 12-27, col.9 lines 30-51, col. 10 line 45 to col. 11 line 57 and col. 12 lines 30- 
64). 

As to claim 6, Giroir discloses the traffic analyzer to comparing the address specifier 
and port specifier combination of the first message against the address specifier and 
port specifier combinations of the previously received messages (see col.9 lines 30-51 
and col. 12 lines 30-64). 
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As to claim 7, Giroir discloses that each message further includes, traffic type specifier; 
and the traffic analyzer is further to compare the traffic type specifier of the first 
message against the traffic type specifiers of the previously received messages (see 
fig.5, col. 10 line 45 to col.1 1 line 57 and col.12 lines 30-64). 

As to claim 8, Giroir discloses each message further includes a traffic type specifier and 
the traffic analyzer is further for comparing the address specifier, port specifier, and 
traffic type specifier of the first message against address specifier, port specifier, and 
traffic type specifier combinations of the previously received messages and to report 
information to the remote location regarding a combination of request types originating 
from the same address specifier and port specifier (see fig.6, col. 8 line 44 to col. 9 line 
51 and col.12 lines 30-64). 

As to claim 13, Giroir discloses a method comprising: 

receiving a first message which includes an address:port identifier (using IP 
datagram including source and destination port, see fig. 3, col. 5 line 57 to col.6 line 41). 

comparing the address:port identifier against previously received messages' 
address:port identifiers (using DT traffic analyzer 511 fig.5) and determining whether 
excessive traffic is originating from a source identified by a common address:port 
identifier of the first message and at least some of previously received messages (see 
fig.5, col.7 line 24 to col.8 line 43 and col.10 lines 13-65). 
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As to claims 14 and 15, Giroir discloses throttling message traffic in response to 
determining that excessive traffic is originating from the source and throttling message 
traffic to and/or from the source (see fig. 5, col. 10 line 45 to col. 11 line 57 and col. 12 
lines 30-64). 

As to claim 16, Giroir discloses comparing the type specifier against type specifiers of 
previously received messages having the same address:port as the first message and 
determining whether the source is issuing messages of different types (see col. 9 lines 
30-51 and col. 12 lines 30-64). 

As to claims 17 and 18, Giroir discloses sending a fraud alert in response to determining 
that the source is issuing messages of different types such as indicate fraud and 
recording the message for use in future comparisons against future messages (see 
col. 10 line 45 to col. 11 line 57 and col. 12 lines 30-64). 

As to claim 19, Giroir discloses receiving an indication of a maximum bandwidth for a 
customer premises from a remote location and throttling message traffic to/from the 
customer premises in response to the indication of the maximum bandwidth (using 
capacity of servers, see col.1 lines 14-27, col. 9 lines 30-51, col. 10 line 45 to col. 11 line 
57 and col. 12 lines 30-64). 

As to claim 20, Giroir discloses a customer premises gateway comprising: 
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at least one first Input/Output I/O (router 515 fig. 5) each to connect to a 
communication device and a second I/O for connecting to the Internet Service Provider 
ISP premises head-end server (503 fig. 5) (using IP datagram including source and 
destination port, see fig. 3, col.1 lines 13-27 and col. 5 line 57 to col. 6 line 41); and 

a traffic analyzer (511 fig. 5) coupled to the at least one first I/O and the second 
I/O, including a port identifier comparator, a throttling mechanism, and a fraud reporter 
to report excessive traffic from a common address identifier and port identifier 
combination of the communication device (see fig. 5, col.7 line 24 to col. 8 line 43 and 
col. 10 lines 13-65). 

As to claim 21, Giroir discloses a message type analyzer (see fig. 5, col.7 line 24 to col. 8 
line 43 and col.10 lines 13-65). 

As to claim 22, Giroir discloses a machine accessible medium including instructions 
which, when executed by the machine, cause the machine to: 

compare a first address:port combination of a message against a second 
address:port combination of a previously received message see fig. 3, col. 5 line 57 to 
col. 6 line 41) and responsive to the address:port comparison, determine whether 
excessive traffic is going to/from the first address:port combination (see fig. 5, col.7 line 
24 to col.8 line 43 and col.10 lines 13-65). 
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As to claim 23, Giroir discloses throttling traffic to/from the first address:port combination 
based on the determination of excessive traffic (see col. 12 lines 20-58 and col. 14 lines 
13-65). 

As to claim 24, Giroir discloses reporting fraud to a service provider at a remote location 
(see fig. 5, col. 7 line 24 to col.8 line 43 and col. 10 lines 13-65). 

As to claim 35, Giroir discloses wherein the communication switch is to be coupled to a 
router at a customer premises, wherein a plurality of systems are to be coupled to the 
router at the customer premises (see fig.7, col. 12 lines 20-58 and col. 14 lines 13-65). 

As to claim 36, Giroir discloses the predetermined maximum aggregate bandwidth is 
based on a bandwidth associated with a customer premises including the 
communication switch (see fig.7, col.12 lines 20-58 and col. 14 lines 13-65). 

Claim Rejections - 35 USC § 103 

4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed 
or described as set forth in section 102 of this title, if the differences between the 
subject matter sought to be patented and the prior art are such that the subject 
matter as a whole would have been obvious at the time the invention was made 
to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was 
made. 
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This application currently nannes joint inventors. In considering patentability of the 
claims under 35 U.S.C. 103(a), the examiner presumes that the subject matter of the 
various claims was commonly owned at the time any inventions covered therein were 
made absent any evidence to the contrary. Applicant is advised of the obligation under 
37 CFR 1.56 to point out the inventor and invention dates of each claim that was not 
commonly owned at the time a later invention was made in order for the examiner to 
consider the applicability of 35 U.S.C. 103(c) and potential 35 U.S.C. 102(e), (f) or (g) 
prior art under 35 U.S.C. 1 03(a). 

5. Claims 25-33 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Giroir in view of Sigaud (hereafter Sigaud), U.S. pat. No.6,657,956. 

As to claims 25 and 26, Giroir*s teachings still applied as in item 3 above. Giroir does 
not specifically disclose masquerading port information and reporting the masquerading. 
However, Sigaud discloses masquerading port information in IP environment and report 
the masquerading (preventing a hacker from connecting at a given moment by 
masquerading as someone else at the terminal connected to the IP network, see fig. 2, 
col.4 line 60 to col. 5 line 65). It would have been obvious to one of the ordinary skill in 
the art at the time the invention was made to incorporate Sigaud's teachings into the 
computer system of Giroir to protect data information because it would have protected a 
stations' access to at least one server and provided selection access to the application 
requested from the server in a communications network. 
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As to claim 27, Giroir discloses a method for a communication switch to detect that a 
device connected to the communication switch is a router, comprising: 

receiving in a communication switch a message from a device (client 501 fig. 5), 
the message including address and sub-address identifiers (using IP datagram 
including source and destination port, see fig. 3, col. 5 line 57 to col.6 line 41). 

comparing the address and sub-address identifiers against one or more 
previously received messages (see fig. 5, col. 7 line 24 to col. 8 line 43 and col. 10 lines 
13-65). 

Giroir does not specifically disclose determining whether the device is performing 
masquerading. However, Sigaud discloses determining whether the device is 
performing masquerading (preventing a hacker from connecting at a given moment by 
masquerading as someone else at the terminal connected to the IP network, see fig.2, 
col.4 line 60 to col. 5 line 65). It would have been obvious to one of the ordinary skill in 
the art at the time the invention was made to incorporate Sigaud's teachings into the 
computer system of Giroir to protect data information because it would have protected a 
stations' access to at least one server and provided selection access to the application 
requested from the server in a communications network. 

As to claims 28 and 29, Giroir discloses observing a first message type indicator in the 
message and a different message type indicator in at least one of the previously 
received messages and recording the address and sub-address identifiers of the 
message, receiving a second message and comparing the second message's address 
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and sub-address identifiers against the recorded address and sub-address identifiers 
(see col.12 lines 20-58 and coL14 lines 13-65). 

As to claim 30, Giroir discloses the address identifier comprises an Internet Protocol 
address and the sub-address identifier comprises a port number (see col.12 lines 20-58 
and col.14 lines 13-65). 

As to claim 31, Giroir discloses sending a fraud alert to a server associated with a 
service provider (see col.1 lines 12-27, col.12 lines 20-58 and col.14 lines 13-65). Giroir 
does not specifically disclose determining whether the device to perform masquerading. 
However, Sigaud discloses determining whether the device to perform masquerading 
(preventing a hacker from connecting at a given moment by masquerading as someone 
else at the terminal connected to the IP network, see fig. 2, col.4 line 60 to col. 5 line 65). 
It would have been obvious to one of the ordinary skill in the art at the time the invention 
was made to incorporate Sigaud's teachings into the computer system of Giroir to 
protect data information because it would have protected a stations* access to at least 
one server and provided selection access to the application requested from the server 
in a communications network. 

As to claims 32 and 33, Giroir discloses throttling message transmission, comparing a 
message type identifier of the message against one or more previously received 
messages and detecting that the message type identifier of the message is different 
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than a message type identifier of a previously received message having a same 
address identifier and a same sub-address identifier as the message communicating an 
alert based on detecting to a remote service provider (using service providers, see col.1 
lines 12-27, col. 10 line 45 to col. 11 line 57 and col. 12 lines 30-64). Giroir does not 
specifically disclose determining whether the device to perform masquerading. 
However, Sigaud discloses determining whether the device to perform masquerading 
(preventing a hacker from connecting at a given moment by masquerading as someone 
else at the terminal connected to the IP network, see fig. 2, col.4 line 60 to col. 5 line 65). 
It would have been obvious to one of the ordinary skill in the art at the time the invention 
was made to incorporate Sigaud's teachings into the computer system of Giroir to 
protect data information because it would have protected a stations' access to at least 
one server and provided selection access to the application requested from the server 
in a communications network. 

Response to Arguments 

6. Applicant's arguments filed on 10/24/2005 have been fully considered but they 
are not persuasive. 

• Applicant asserts that the cited reference does not disclose a communication 
switch including an output to report a result of a comparison switch of a port 
specifier of a first message against the port specifiers of previously received 
messages. 
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Examiner respectfully disagrees, Giroir discloses a method of delivering a 
datagram across multiple inter-network servers using a dispatcher system (507 fig, 5), 
Specifically, Giroir discloses a traffic analyzer (DT traffic analyzer 511 fig. 5) to compare 
the port specifier of a first message against the port specifiers of previously received 
messages (analyzing the IP datagrams and determining the device type and then 
selecting the optimal server for forwarding the IP datagrams, see col. 7 line 24 to col.8 
line 43 and col. 10 lines 13-65) as rejected above. 

• Applicant asserts that the cited reference does not disclose determining whether 
excessive traffic is originating from a source identified by a common address:port 
identifier of the first message and at least some of previously received 
messages. 

Examiner respectfully point out that Giroir discloses determining whether 
excessive traffic is originating from a source identified by a common address:port 
identifier of the first message and at least some of previously received messages 
(using traffic analyzer to analyze the IP datagrams and to determine the device 
type or traffic priority or discard eligibility based on characteristics of the traffic to 
a selected server, see fig. 5, col.7 line 24 to col.8 line 43). Furthermore, Giroir 
discloses using a table containing a list of records 612, each record including a 
Cx_SourceJP_Address field 613, a Cx_Source_Port field 614] a Cx 
DestJP_Address field 615, a Cx_Dest_Port field 616, and a CxJDeviceJType 
field 617 for processing data traffic (see fig. 6, col. 10 lines 12-50). 
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• Applicant asserts that the cited reference does not disclose a fraud reporter to 
report excessive traffic from a common address identifier and port identifier 
combination of the communication device. 

Examiner respectfully point out that Giroir discloses a fraud reporter to report 
excessive traffic from a common address identifier and port identifier combination of 
the communication device (using traffic analyzer to analyze the IP datagrams and to 
determine the device type or traffic priority or discard eligibility based on 
characteristics of the traffic to a selected sen/en see fig. 5, colJ line 24 to col. 8 line 
43 and coL 10 lines 13-65). 

• Applicant asserts that the cited reference does not disclose responsive to the 
address:port comparison, determine whether excessive traffic is going to/from 
the first address:port combination (see fig. 5, col. 7 line 24 to col. 8 line 43 and 
col. 10 lines 13-65). 

Examiner respectfully point out that Giroir discloses responsive to the address:port 
comparison, determine whether excessive traffic is going to/from the first 
address.'port combination (using data dispatcher to test the datagrams, see fig. 5, 
col. 7 line 24 to coL8 line 43 and col. 10 lines 13-65). 
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• Applicant asserts that the cited references do not disclose performing 
masquerading based on a comparison of address and sub-address identifiers 
against one or more previously received messages. 

Examiner respectfully point out that the combination of Giroir and Sigaud 
discloses the Applicants claimed invention. For example, Giroir discloses comparing 
the address and sub-address identifiers against one or more previously received 
messages (using data dispatcher to test the datagrams, see figs, 5, 6, colJ line 24 to 
col. 8 line 43 and col. 10 lines 13-65), Giroir does not specifically disclose determining 
whether the device is performing masquerading. However, Sigaud discloses 
determining whether the device is performing masquerading (preventing a hacker from 
connecting at a given moment by masquerading as someone else at the terminal 
connected to the IP network, see fig. 2, col.4 line 60 to col. 5 line 65). It would have 
been obvious to one of the ordinary skill in the art at the time the invention was made to 
incorporate Sigaud's teachings into the computer system of Giroir to protect data 
information because it would have protected a stations' access to at least one server 
and provided selection access to the application requested from the server in a 
communications network. 

• Applicant further asserts that there is no suggestion or motivation to combine the 
references. 

In response to applicant's argument that there is no suggestion to combine the 
references, the examiner recognizes that obviousness can only be established by 
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combining or modifying the teachings of the prior art to produce the claimed invention 
where there is some teaching, suggestion, or motivation to do so found either in the 
references themselves or in the knowledge generally available to one of ordinary skill in 
the art. See In re Fine, 837 F.2d 1071, 5 USPQ2d 1596 (Fed. Cir 1988) and In re 
Jones, 958 F.2d 347, 21 USPQ2d 1941 (Fed. Cir 1992). In this case, it would have 
protected a stations' access to at least one server and provided selection access to the 
application requested from the server in a communications network. 

Therefore, the examiner asserts that cited prior art teaches or suggests the subject 
matter broadly recited in independent claims 1, 13, 20, 22 and 27. 
Claims 2-8, 14-19, 21, 23-26, 28-33, 35 and 36 are also rejected at least by virtue of 
their dependency on independent claims and by other reasons set forth in the previous 
office action [mailed on 7/27/2005 and this Office Action]. Accordingly, claims 1-8, 13- 
33, 35 and 36 are respectfully rejected. 

Conclusion 

7. Claims 1-8, 13-33, 35 and 36 are rejected. 

8. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 .1 36(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply Is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
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mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

9. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Khanh Dinh whose telephone number is (571) 272- 
3936. The examiner can normally be reached on Monday through Friday from 8:00 A.m. 
to 5:00 P.m. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Zarni Maung, can be reached on (571) 272-3939. The fax phone number 
for this group is (571) 273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for published 
applications may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through Private PAIR only. For 
more information about the PAIR system, see http://pair-direct.uspto.gov. Should you 
have questions on access to the Private PAIR system, contact the Electronic Business 
Center (EBC) at 866-217-9197 (toll-free). 

Khanh Dinh 
Primary Examiner 
Art Unit 2151 
1/5/2006 



